Anthropic Decouples AI Agent Brain from Hands, Cutting TTFT Latency by 90%

Anthropic engineers published a technical breakdown of the architecture powering Managed Agents, a service designed to run long-horizon autonomous tasks using Claude. The team moved away from monolithic containers where the neural network, code execution environment, and session log all shared the same runtime. Decoupling the "brain," "hands," and state log slashed median time-to-first-token (TTFT) latency by 60% (p50) and by over 90% at the 95th percentile (p95), while eliminating structural security vulnerabilities along the way.

Retiring Pet Servers

Early on, the orchestrator harness and the sandbox ran inside a single container. While that simplified filesystem calls, it created the classic infrastructure problem of "pet servers." If a container froze or crashed due to a network glitch, the session was permanently lost. Engineers could not safely attach to the process for debugging because user data lived inside the working environment. On top of that, connecting to customer Virtual Private Clouds (VPCs) required complex network peering.

With Managed Agents, the system is split into three independent primitives: the session (an immutable, append-only event log), the harness (the Claude invocation and tool-routing loop), and the sandbox (the compute environment). The sandbox container became an interchangeable resource. If an execution environment fails, the control loop catches the tool-call error, forwards it to the model, and restarts the isolated environment when needed via a declarative `provision()` call.

Out-of-Context Sessions and Security Boundaries

Long-running tasks inevitably exhaust the context window. Traditional approaches like summarization or truncating older message blocks are lossy and irreversible: the model risks discarding details it might need dozens of steps later. In Managed Agents, history is preserved in a persistent log outside the model's context. A `getEvents()` interface allows the agent to query the log with arbitrary offsets, review historical context before taking an action, and rebuild context to maximize prompt caching efficiency.

The redesign also solves secret leakage caused by prompt injection. Previously, malicious code could trick Claude into reading its own environment variables. In the new setup, credentials never enter the sandbox:

• TTFT latency dropped by ~60% for p50 and over 90% for p95 thanks to lazy initialization of heavy containers. • Execution environment calls are standardized to an `execute(name, input) -> string` signature, allowing the agent to control arbitrary external systems and emulators. • Git keys and OAuth tokens are isolated in an external vault and consumed through a secure MCP proxy. • The fault-tolerant harness loop restarts via a `wake(sessionId)` command, resuming execution from the last acknowledged record in the log.

A Meta-Harness for Future Models

Building universal interfaces on top of rapidly evolving models mirrors the evolution of operating systems, where the `read()` syscall is abstracted away from the underlying storage hardware. During testing with Claude Sonnet 4.5, developers ran into "context anxiety," where the model prematurely wrapped up work as it approached token limits, requiring forced overrides in harness code. In Claude Opus 4.5, that behavioral quirk vanished, turning those workarounds into dead weight. The modular architecture eliminates reliance on transient LLM limitations, allowing multi-agent clusters across dozens of sandboxes to scale across future model generations.